Add /fork and /rewind slash commands

[Aarya2004]

Completes #537, on top of #560.

Stacked. This builds on #560 and must merge after it. GitHub requires a base branch in this repository, so the base here is main and the diff shows #560's commits until that lands. The commits unique to this PR start at Register /fork and /rewind slash commands.

Clean diff. The true stacked view, only this PR's nine commits, is at Aarya2004#2, which is based on #560's branch inside the fork. Aarya2004#1 mirrors #560 the same way. Those mirrors are review views only; this PR is the submission.

Why

#560 added fx session fork and fx session rewind, which work from a script or a second terminal. Issue #537 asks for them where the conversation actually is, in the shell.

The two commands are not symmetric, and the asymmetry is forced by a lock. A live shell holds its own session's writer lock, so calling either store primitive on the current session fails:

$ fx session fork <live-session-id> --at 1
fx session: session is busy or the filesystem cannot provide the required lock

So /fork releases the lock and re-enters, while /rewind stays in process and rewrites what it already owns.

● Session: /rewind 2 drops the last 2 turns and leaves 1. Run /rewind 2 again to confirm. File changes are not reverted.
● Session: Rewound 2 turns; 1 turn left. File changes were not reverted.

● Session: Forked <src> at turn 2 into <dst>. You are now in the branch; <src> is unchanged.

Scope

forkLiveSession in src/core/app/app_session_runtime.zig refuses while a stream is active, validates the turn, settles the worker, calls closeWritableSession to release the lock, calls Store.forkSessionCopy, then enters the branch through the same loadResumeTargetForWrite to installResumedSession path /resume uses. Background policy is carry_forward, not stop_forget, because the source survives a fork.

rewindLiveSession does not call Store.rewindSession. This process already holds the lock, so it truncates the live history and commits through commitCurrentStateReplacement with reason .rewind. Same durable event, issued by the owner.

session.zig gains dropHistoryTurnsAfter, which owns freeing dropped turns and clamping context_history_start. session_store.zig's truncateSessionHistory now calls it, so the store's slice reallocation and the live list shrink share one rule.

RewindGate is a union of idle and armed: RewindTarget, where the target carries both history_len and retained_turns. Arming on the whole target rather than the raw count means a turn arriving between the preview and the confirmation re-arms instead of firing a rewind nobody previewed. route in command_router.zig splits into parse plus dispatch so the gate has exactly one disarm site.

Registration spans the five sites Zig's exhaustive switches enforce: SlashKind in command_specs.zig, the specs in builtins/commands.zig, ParsedCommand and CommandHandlers in command_router.zig, the handlers in app_commands.zig, and the behavior in app_session_runtime.zig.

Out of scope: the interactive turn picker. Bare /fork prints usage naming the live session id so the fx session <id> command can be pasted as written. The picker is a new alternate-screen catalog menu and belongs in its own change.

Tradeoffs

/rewind requires the identical command twice. fx has no y/n prompt and no slash command confirms today; the only precedent is the arming reducer in src/core/mcp/menu_state.zig, and this follows its shape. Any intervening command disarms.

Both rewind messages say file changes are not reverted. Claude Code's /rewind restores files through checkpoints and fx's does not, so users arriving from it will expect their working tree back. Saying so costs one clause and prevents a bad surprise.

/rewind cannot un-print. Inline rendering only appends and viewport_top_row never grows back, so dropped turns stay in scrollback above the notice. The persisted history is correct. /fork escapes this only because the resume path resets and replays.

turnPlural is duplicated, two lines, private in cli_surface.zig and app_commands.zig. Sharing it would make the app layer import the CLI surface, which is the wrong direction.

The rule that a rewind clears a paused response is stated twice: commitCurrentStateReplacement takes clear_recovery_checkpoint for the live path, and Store.rewindSession clears it directly for the CLI path. They operate on different types in different layers, so folding them together would invert the dependency. Both are covered by tests.

Blast Radius

/fork closes the live session before it can fork, so every failure after that point must leave the shell usable. All four failure sites route through one forkFailure helper that reopens the source first, and ForkOutcome is a union of branched and failed so an id and a problem cannot both be optional on one struct.

Forced at runtime by chmod 0555 on the sessions directory, which blocks the fork's staging directory while leaving the session writable:

● Session: Could not fork <id> (AccessDenied). This shell is still on <id>.

The next prompt persisted into the source and no branch was created.

Existing commands are unaffected. No public API was removed. The route split is internal to the router.

Verification

zig fmt --check src/ and zig build clean. ./scripts/check-public-surface.sh clean.

zig build test: 8647 of 8677 pass, 20 skipped, 10 failed. The failing set is byte-identical to this branch's base: six app_session_runtime session-picker and resume tests, command_effect native printf, builtins.tools terminal schema, transcript.runtime_tests tool status, and app_mcp_runtime authority reduction. None touch the slash-command chain. The new unit tests were proven to run by breaking an assertion and watching the failure count rise.

E2E: tui-session-fork.test.ts 6 pass, tui-slash-menu.test.ts 38 pass, plus tui-resize 49, tui-input-navigation / tui-render-stress / tui-gateway-stream-lifecycle 111, tui-startup / prompt-history 11, ci-shards 7.

Driven by hand against the real TUI on a fake model, through tmux. Confirmed there: the first /rewind 2 arms without executing; an intervening /version disarms so the next /rewind 2 re-arms rather than firing; two consecutive invocations execute, with an independent read-back showing history_len drop from 3 to 1; /fork 2 reports both ids and lands in the branch, with read-back showing branch [alpha, delta] against unchanged source [alpha, delta, echo]; the shell stays writable in the branch; and out-of-range arguments on both verbs name the real history length without changing the session.

Not verified: the fresh_session and no_session fork landings. Only the source landing was forced. Reaching the others needs the source reopen to fail while a fresh session can still be created, and that state could not be constructed.

tui-session-fork.test.ts is classified verification-only in scripts/pgso/corpus.json with requires_tmux: true.

This PR needs the type: feature label. I cannot apply labels on this repository.